vibecarbon 0.1.7 → 0.2.1

package/services/n8n/hooks/hooks.js

@@ -0,0 +1,131 @@
+/**
+ * n8n ForwardAuth SSO Hook
+ *
+ * Reads X-User-Email set by Traefik ForwardAuth, looks up or auto-creates
+ * the n8n user, and issues a session cookie — bypassing n8n's login page.
+ *
+ * When ForwardAuth headers are absent (dev mode without Traefik, or direct
+ * container access), falls through to n8n's normal login flow.
+ *
+ * Loaded via EXTERNAL_HOOK_FILES environment variable.
+ */
+
+const SKIP_PATHS = ['/healthz', '/webhook', '/assets', '/rest/oauth2-credential'];
+
+function shouldSkip(url) {
+  return SKIP_PATHS.some((p) => url.startsWith(p));
+}
+
+module.exports = {
+  n8n: {
+    ready: [
+      async function (server) {
+        const userRepo = this.dbCollections?.User;
+        if (!userRepo) {
+          console.warn('[hooks.js] User repository not available — SSO hook disabled');
+          return;
+        }
+
+        // Get AuthService from DI container for issueCookie
+        let authService;
+        try {
+          const { Container } = require('@n8n/di');
+          const { AuthService } = require('/usr/local/lib/node_modules/n8n/dist/auth/auth.service');
+          authService = Container.get(AuthService);
+        } catch (err) {
+          console.warn('[hooks.js] Could not resolve AuthService:', err.message);
+        }
+
+        const app = server.app;
+        if (!app) {
+          console.warn('[hooks.js] server.app not available');
+          return;
+        }
+
+        // Express 5 uses app.router.stack, Express 4 uses app._router.stack
+        const layers = app.router?.stack ?? app._router?.stack;
+        if (!layers) {
+          console.warn('[hooks.js] Could not access Express router stack — SSO hook disabled');
+          return;
+        }
+
+        let cookieParserIdx = -1;
+        for (let i = 0; i < layers.length; i++) {
+          if (layers[i].name === 'cookieParser') {
+            cookieParserIdx = i;
+            break;
+          }
+        }
+
+        const middleware = async (req, res, next) => {
+          try {
+            if (shouldSkip(req.url)) return next();
+
+            // Skip if session already exists
+            if (req.cookies?.['n8n-auth']) return next();
+
+            const email = req.headers['x-user-email'];
+            if (!email) return next(); // No ForwardAuth headers — normal login
+
+            let user = await userRepo.findOne({
+              where: { email },
+              relations: ['role'],
+            });
+
+            if (!user) {
+              // Auto-create user with owner role and random password
+              const crypto = require('node:crypto');
+              const { hashSync } = require('bcryptjs');
+              const randomPassword = crypto.randomBytes(32).toString('hex');
+
+              user = userRepo.create({
+                email,
+                firstName: email.split('@')[0],
+                lastName: '',
+                password: hashSync(randomPassword, 10),
+                roleSlug: 'global:owner',
+              });
+              user = await userRepo.save(user);
+              // Reload with role relation
+              user = await userRepo.findOne({
+                where: { email },
+                relations: ['role'],
+              });
+            }
+
+            if (!user) return next();
+
+            // Issue session cookie via AuthService
+            if (authService) {
+              try {
+                authService.issueCookie(res, user, false, undefined);
+              } catch (cookieErr) {
+                console.error('[hooks.js] SSO: issueCookie failed:', cookieErr.message);
+              }
+            }
+
+            return next();
+          } catch (err) {
+            console.error('[hooks.js] ForwardAuth SSO error:', err.message);
+            return next();
+          }
+        };
+
+        // Inject middleware after cookie-parser so req.cookies is available.
+        // Must create a proper Layer instance (Express 5 router calls layer.match()).
+        if (cookieParserIdx >= 0) {
+          try {
+            const Layer = require('router/lib/layer');
+            const layer = new Layer('/', { end: false }, middleware);
+            layers.splice(cookieParserIdx + 1, 0, layer);
+            console.log('[hooks.js] ForwardAuth SSO middleware installed');
+          } catch (err) {
+            console.warn('[hooks.js] Could not create router Layer:', err.message);
+          }
+        } else {
+          console.warn('[hooks.js] cookie-parser not found — SSO hook disabled');
+        }
+      },
+    ],
+  },
+};

package/services/n8n/k8s/deployment.yaml

@@ -0,0 +1,116 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n
+  labels:
+    app: vibecarbon-n8n
+    component: automation
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vibecarbon-n8n
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-n8n
+        component: automation
+    spec:
+      securityContext:
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: n8n
+        image: n8nio/n8n:latest
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 5678
+          name: http
+        env:
+        - name: N8N_BASIC_AUTH_ACTIVE
+          value: 'false'
+        - name: N8N_HOST
+          value: 0.0.0.0
+        - name: N8N_PORT
+          value: '5678'
+        - name: N8N_PROTOCOL
+          value: http
+        - name: N8N_PATH
+          value: /admin/n8n/
+        - name: NODE_ENV
+          value: production
+        - name: WEBHOOK_URL
+          valueFrom:
+            configMapKeyRef:
+              name: vibecarbon-config
+              key: SITE_URL
+        - name: GENERIC_TIMEZONE
+          value: UTC
+        - name: DB_TYPE
+          value: postgresdb
+        - name: DB_POSTGRESDB_HOST
+          value: postgres
+        - name: DB_POSTGRESDB_PORT
+          value: '5432'
+        - name: DB_POSTGRESDB_DATABASE
+          value: n8n
+        - name: DB_POSTGRESDB_USER
+          value: n8n
+        - name: DB_POSTGRESDB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: DB_PASSWORD
+        - name: SUPABASE_URL
+          value: http://kong:8000
+        - name: SUPABASE_ANON_KEY
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: ANON_KEY
+        - name: SUPABASE_SERVICE_ROLE_KEY
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: SERVICE_ROLE_KEY
+        - name: N8N_SECURE_COOKIE
+          value: 'true'
+        volumeMounts:
+        - name: n8n-data
+          mountPath: /home/node/.n8n
+        - name: tmp-vol-0
+          mountPath: /tmp
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 1000m
+            memory: 1Gi
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+      volumes:
+      - name: n8n-data
+        persistentVolumeClaim:
+          claimName: n8n-data
+      - name: tmp-vol-0
+        emptyDir: {}

package/services/n8n/k8s/ingressroute.yaml

@@ -0,0 +1,24 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: vibecarbon-n8n
+  namespace: vibecarbon
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # N8N_PATH=/admin/n8n/ makes n8n generate HTML with /admin/n8n/assets/... paths.
+    # strip-prefix removes /admin/n8n before forwarding, so n8n serves assets at /assets/...
+    # and the REST API at /rest/... — exactly what the browser requests after stripping.
+    - match: PathPrefix(`/admin/n8n`)
+      kind: Rule
+      priority: 20
+      services:
+        - name: n8n
+          port: 5678
+      middlewares:
+        - name: admin-auth
+        - name: security-headers
+        - name: strip-admin-n8n-prefix
+  tls:
+    secretName: vibecarbon-tls

package/services/n8n/k8s/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - pvc.yaml
+  - network-policy.yaml
+  - ingressroute.yaml

package/services/n8n/k8s/network-policy.yaml

@@ -0,0 +1,82 @@
+---
+# Network policy for n8n automation service
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: n8n-policy
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-n8n
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-traefik
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-app
+      ports:
+        - protocol: TCP
+          port: 5678
+  egress:
+    # DNS resolution
+    - ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # PostgreSQL
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-postgres
+      ports:
+        - protocol: TCP
+          port: 5432
+    # Kong (Supabase API gateway)
+    - to:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-kong
+      ports:
+        - protocol: TCP
+          port: 8000
+    # External HTTP/HTTPS (for webhook calls, npm packages, etc.)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - protocol: TCP
+          port: 443
+        - protocol: TCP
+          port: 80
+---
+# Allow n8n to connect to postgres
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: n8n-database-ingress
+  namespace: vibecarbon
+spec:
+  podSelector:
+    matchLabels:
+      app: vibecarbon-postgres
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: vibecarbon-n8n
+      ports:
+        - protocol: TCP
+          port: 5432

package/services/n8n/k8s/pvc.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data
+  labels:
+    app: vibecarbon-n8n
+    component: automation
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: hcloud-volumes
+  resources:
+    requests:
+      storage: 5Gi

package/services/n8n/k8s/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n
+  labels:
+    app: vibecarbon-n8n
+    component: automation
+spec:
+  selector:
+    app: vibecarbon-n8n
+  ports:
+    - port: 5678
+      targetPort: 5678
+      name: http

package/services/n8n/manifest.json

@@ -0,0 +1,36 @@
+{
+  "name": "n8n",
+  "description": "Workflow automation platform",
+  "version": "1.0.0",
+  "port": 5678,
+  "url": "http://n8n.localhost",
+
+  "files": {
+    "compose/docker-compose.yml": "docker-compose.n8n.yml",
+    "compose/docker-compose.prod.yml": "docker-compose.n8n.prod.yml",
+    "compose/docker-compose.override.yml": "docker-compose.n8n.override.yml",
+    "k8s/": "k8s/base/n8n/",
+    "db/init.sh": "volumes/db/n8n-init.sh",
+    "scripts/setup.sh": "volumes/n8n/scripts/setup.sh",
+    "hooks/hooks.js": "volumes/n8n/hooks.js",
+    "docs/integration.md": "n8n-integration.md"
+  },
+
+  "envVars": {
+    "N8N_WEBHOOK_URL": { "value": "http://localhost:5678" },
+    "N8N_API_KEY": { "value": "" },
+    "N8N_ADMIN_EMAIL": { "from": "ADMIN_EMAIL", "default": "admin@localhost" }
+  },
+
+  "credentials": {
+    "title": "n8n",
+    "fields": [
+      { "label": "URL", "value": "http://n8n.localhost" },
+      { "label": "Auth", "value": "Traefik ForwardAuth SSO (super_admin)" }
+    ]
+  },
+
+  "kustomization": {
+    "entry": "n8n/"
+  }
+}

package/services/n8n/scripts/setup.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+# n8n DB-Only Setup Script
+# Inserts the owner user directly into PostgreSQL so n8n's setup wizard is skipped.
+# Auth is handled by ForwardAuth + hooks.js — the password here is a placeholder.
+# Added via: vibecarbon add n8n
+
+set -e
+
+DB_HOST="${N8N_DB_HOST:-db}"
+DB_NAME="${N8N_DB_NAME:-n8n}"
+DB_USER="${N8N_DB_USER:-n8n}"
+DB_PASSWORD="${N8N_DB_PASSWORD}"
+ADMIN_EMAIL="${N8N_ADMIN_EMAIL:-admin@localhost}"
+
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >&2; }
+
+if [ -z "$DB_PASSWORD" ]; then
+  log "ERROR: N8N_DB_PASSWORD is required"
+  exit 1
+fi
+
+# Wait for n8n's user table to exist (created by n8n's own migrations)
+log "Waiting for n8n user table..."
+for i in $(seq 1 60); do
+  if PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -tAc \
+    "SELECT 1 FROM information_schema.tables WHERE table_name='user'" 2>/dev/null | grep -q 1; then
+    break
+  fi
+  [ "$i" -eq 60 ] && { log "ERROR: user table not found after 5 minutes"; exit 1; }
+  sleep 5
+done
+
+# Insert owner with random password placeholder and global:owner role.
+# ON CONFLICT DO NOTHING — idempotent across restarts.
+RANDOM_HASH=$(head -c 32 /dev/urandom | base64)
+PGPASSWORD="$DB_PASSWORD" psql -h "$DB_HOST" -U "$DB_USER" -d "$DB_NAME" -q <<SQL
+INSERT INTO "user" (email, "firstName", "lastName", password, role)
+VALUES ('${ADMIN_EMAIL}', 'Admin', 'User', '${RANDOM_HASH}', 'global:owner')
+ON CONFLICT (email) DO NOTHING;
+SQL
+
+log "n8n owner setup complete (email: ${ADMIN_EMAIL})"

package/{carbon/docker-compose.observability.prod.yml → services/observability/compose/docker-compose.prod.yml}

@@ -26,3 +26,11 @@ services:
       - "traefik.http.routers.grafana-http.rule=Host(`grafana.${DOMAIN}`)"
       - "traefik.http.routers.grafana-http.entrypoints=web"
       - "traefik.http.routers.grafana-http.middlewares=redirect-to-https"
+
+  # Prometheus and Loki have no Traefik route; Grafana/Promtail reach them over
+  # the compose network. Drop the dev host-port publishing so prod never binds
+  # them on the host (defense-in-depth behind the 22/80/443-only firewall).
+  prometheus:
+    ports: []
+  loki:
+    ports: []

package/services/observability/docs/integration.md

@@ -0,0 +1,31 @@
+# Observability (Prometheus · Grafana · Loki)
+
+This add-on installs a self-contained monitoring stack into your project for
+both the Docker Compose and Kubernetes deploy modes.
+
+## What gets installed
+
+| File / dir | Purpose |
+|------------|---------|
+| `docker-compose.observability.yml` (+ `.prod.yml`, `.override.yml`) | Compose overlay for Prometheus, Grafana, Loki, Promtail, postgres-exporter |
+| `volumes/prometheus/`, `volumes/loki/`, `volumes/promtail/`, `volumes/grafana/` | Scrape config, log pipeline, datasources, and dashboards (prod + dev variants) |
+| `k8s/base/observability/` | Kubernetes manifests + a kustomization, wired into `k8s/base/kustomization.yaml` |
+
+The `observability/` entry is added to `k8s/base/kustomization.yaml`, so a
+`kubectl apply -k k8s/base` (run by `vibecarbon deploy` on the k8s tiers) brings
+the stack up alongside the app.
+
+## Access
+
+- **Compose:** Grafana at `http://grafana.localhost`, Prometheus at
+  `http://prometheus.localhost`, Loki at `http://loki.localhost`. Dev mode skips
+  Grafana auth; production puts Grafana behind Traefik with TLS.
+- **Kubernetes:** Grafana is exposed at `/admin/grafana` behind the Traefik
+  `admin-auth` middleware (super-admin SSO). Prometheus (`:9090`) and Loki
+  (`:3100`) stay in-cluster.
+
+## Removing
+
+`vibecarbon remove observability` deletes the installed configs and the
+kustomization entry. Persisted volume data (Grafana DB, Prometheus/Loki storage)
+is left in place.

package/services/observability/k8s/grafana-deployment.yaml

@@ -0,0 +1,107 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grafana
+  labels:
+    app: vibecarbon-grafana
+    component: observability
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: vibecarbon-grafana
+  template:
+    metadata:
+      labels:
+        app: vibecarbon-grafana
+        component: observability
+    spec:
+      securityContext:
+        fsGroup: 472
+        runAsUser: 472
+        runAsGroup: 472
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: grafana
+        image: grafana/grafana:latest
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 3000
+          name: http
+        env:
+        - name: GF_SECURITY_ADMIN_USER
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: ADMIN_EMAIL
+        - name: GF_SECURITY_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: vibecarbon-secrets
+              key: ADMIN_PASSWORD
+        - name: GF_AUTH_ANONYMOUS_ENABLED
+          value: 'true'
+        - name: GF_AUTH_ANONYMOUS_ORG_ROLE
+          value: Admin
+        - name: SITE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: vibecarbon-config
+              key: SITE_URL
+        - name: GF_SERVER_ROOT_URL
+          value: $(SITE_URL)/admin/grafana/
+        - name: GF_SERVER_SERVE_FROM_SUB_PATH
+          value: 'true'
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/grafana
+        - name: datasources
+          mountPath: /etc/grafana/provisioning/datasources
+          readOnly: true
+        - name: dashboards-provisioning
+          mountPath: /etc/grafana/provisioning/dashboards
+          readOnly: true
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          initialDelaySeconds: 15
+          periodSeconds: 20
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /api/health
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 3
+          failureThreshold: 3
+        securityContext:
+          allowPrivilegeEscalation: false
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: grafana-pvc
+      - name: datasources
+        configMap:
+          name: grafana-provisioning
+          items:
+          - key: datasources.yml
+            path: datasources.yml
+      - name: dashboards-provisioning
+        configMap:
+          name: grafana-provisioning
+          items:
+          - key: dashboards.yml
+            path: dashboards.yml

package/services/observability/k8s/grafana-provisioning-configmap.yaml

@@ -0,0 +1,65 @@
+# =============================================================================
+# GRAFANA PROVISIONING CONFIGMAP
+# =============================================================================
+# Pre-configures Grafana datasources (Prometheus, Loki, PostgreSQL) and
+# dashboard provisioning so Grafana starts ready-to-use without manual setup.
+# Mirrors the Docker Compose provisioning in volumes/grafana/provisioning/.
+#
+# Note: $DB_PASSWORD in the PostgreSQL datasource is a Grafana variable
+# reference (resolved by Grafana from its own env), not a shell variable.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-provisioning
+  labels:
+    app: vibecarbon-grafana
+    component: observability
+data:
+  datasources.yml: |
+    apiVersion: 1
+    datasources:
+      - name: Prometheus
+        type: prometheus
+        uid: prometheus
+        access: proxy
+        url: http://prometheus:9090
+        isDefault: true
+        editable: false
+        jsonData:
+          httpMethod: POST
+          timeInterval: "15s"
+      - name: Loki
+        type: loki
+        uid: loki
+        access: proxy
+        url: http://loki:3100
+        editable: false
+        jsonData:
+          maxLines: 1000
+      - name: PostgreSQL
+        type: postgres
+        uid: postgres
+        url: postgres:5432
+        database: postgres
+        user: supabase_admin
+        jsonData:
+          sslmode: disable
+          maxOpenConns: 5
+          maxIdleConns: 2
+          connMaxLifetime: 14400
+        secureJsonData:
+          password: $DB_PASSWORD
+        editable: false
+  dashboards.yml: |
+    apiVersion: 1
+    providers:
+      - name: 'vibecarbon'
+        orgId: 1
+        folder: 'vibecarbon'
+        folderUid: 'vibecarbon'
+        type: file
+        disableDeletion: false
+        updateIntervalSeconds: 30
+        allowUiUpdates: true
+        options:
+          path: /var/lib/grafana/dashboards